latentbot | d4c371d9f2dcbf10e5431613552c9402eb2173949438616b831ebe3d9c5d46f3

Analysis

max time kernel
300s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2025, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FVGSetup.exe
Size

38.0MB
MD5

f94f1582b9960e4bb251ab46e18d35ae
SHA1

42dda48371f0d7fb128ae0ee89dcbdc1df520509
SHA256

d4c371d9f2dcbf10e5431613552c9402eb2173949438616b831ebe3d9c5d46f3
SHA512

a56705417c803a8d9bfe01ff80697fd2ea5530aab0bcbc4712ad1e3961c539d21be4a23f57ded1543fa2aa7ae57953e79704c0ee21a170345edcb6fc42b8d23d
SSDEEP

786432:vquggO6BVbMYLy+//BaGXhqavcPz2qbSIpRQwoS8QEZX3FPZ+aMuwmJrzE4vv89Y:vlggO6BVn1UGxB0Pz2qbSIpRQwoS8QEZ

Score

10^/10

latentbot discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

latentbot

freevpnguard.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\""	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.12-I001 amd64"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1"	MsiExec.exe

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\SET5918.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File created	C:\Windows\System32\drivers\SET5CE0.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET52ED.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET5CE0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\ovpn-dco.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET52ED.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\wintun.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET5918.tmp	DrvInst.exe

Executes dropped EXE 5 IoCs

pid	Process
1952	openvpnserv.exe
2872	openvpnserv2.exe
2236	Free-VPN-Guard.exe
3984	DeviceAssociationBrokerSvc_60ca11.exe
4316	openvpn.exe

Loads dropped DLL 18 IoCs

pid	Process
2236	MsiExec.exe
2236	MsiExec.exe
2236	MsiExec.exe
2236	MsiExec.exe
2236	MsiExec.exe
3672	MsiExec.exe
3672	MsiExec.exe
3672	MsiExec.exe
3672	MsiExec.exe
3672	MsiExec.exe
1952	openvpnserv.exe
3672	MsiExec.exe
3672	MsiExec.exe
2236	MsiExec.exe
4316	openvpn.exe
4316	openvpn.exe
4316	openvpn.exe
4316	openvpn.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Windows\\system32\\taskhostw.exe"	Free-VPN-Guard.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
29	4152	msiexec.exe
29	4152	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
83	ifconfig.me

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{43270e39-8f8f-ae4c-b20e-737d47d20197}\SET489D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{43270e39-8f8f-ae4c-b20e-737d47d20197}\SET489D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f8615c9-ddeb-e149-b127-fb6956f1825e}\ovpn-dco.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{43270e39-8f8f-ae4c-b20e-737d47d20197}\SET48AE.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4f8615c9-ddeb-e149-b127-fb6956f1825e}\SET5040.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{65d429e7-c15d-3b41-9ab8-3aa0c7ed6034}\SET4F35.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{65d429e7-c15d-3b41-9ab8-3aa0c7ed6034}\tap0901.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f8615c9-ddeb-e149-b127-fb6956f1825e}\SET503E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\netrndis.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{65d429e7-c15d-3b41-9ab8-3aa0c7ed6034}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{65d429e7-c15d-3b41-9ab8-3aa0c7ed6034}\SET4F34.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{65d429e7-c15d-3b41-9ab8-3aa0c7ed6034}\SET4F36.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ykinx64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF	MsiExec.exe
File created	C:\Windows\system32\DeviceAssociationBrokerSvc_60ca11.exe	Free-VPN-Guard.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f8615c9-ddeb-e149-b127-fb6956f1825e}\ovpn-dco.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f8615c9-ddeb-e149-b127-fb6956f1825e}\ovpn-dco.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{43270e39-8f8f-ae4c-b20e-737d47d20197}\SET48AD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4f8615c9-ddeb-e149-b127-fb6956f1825e}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{43270e39-8f8f-ae4c-b20e-737d47d20197}\SET48AE.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4f8615c9-ddeb-e149-b127-fb6956f1825e}\SET503F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{43270e39-8f8f-ae4c-b20e-737d47d20197}\wintun.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{65d429e7-c15d-3b41-9ab8-3aa0c7ed6034}\SET4F36.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\OemVista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\oemvista.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\c_net.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF	MsiExec.exe

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File created	C:\Program Files\OpenVPN\res\ovpn.ico	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\config-auto\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\openvpn.8.html	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf	msiexec.exe
File created	C:\Program Files\OpenVPN\include\tap-windows.h	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libopenvpn_plap.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-uninstall.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\config\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\INSTALL-win32.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv2.exe	msiexec.exe
File opened for modification	C:\Program Files\FreeVpnGuard\Free-VPN-Guard.exe	FVGSetup.exe
File created	C:\Program Files\FreeVpnGuard\OpenVPN-2.6.12-I001-amd64.msi	FVGSetup.exe
File created	C:\Program Files\OpenVPN\sample-config\client.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\ssl\modules\legacy.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\log\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\tapctl.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\license.txt	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.cat	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\server.ovpn	msiexec.exe
File opened for modification	C:\Program Files\FreeVpnGuard\OpenVPN-2.6.12-I001-amd64.msi	FVGSetup.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.sys	msiexec.exe
File created	C:\Program Files\OpenVPN\config\empty.ovpn	FVGSetup.exe
File created	C:\Program Files\FreeVpnGuard\Free-VPN-Guard.exe	FVGSetup.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-gui.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg	msiexec.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{68900C00-D1AC-4940-B63A-CABA2BF18B17}	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4B54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{68900C00-D1AC-4940-B63A-CABA2BF18B17}\openvpn.ico	msiexec.exe
File created	C:\Windows\INF\oem5.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI673E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3479.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4FCA.tmp	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem4.PNF	MsiExec.exe
File created	C:\Windows\Installer\e5830d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39BA.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\Installer\{68900C00-D1AC-4940-B63A-CABA2BF18B17}\openvpn.ico	msiexec.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\Installer\e5830cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D4A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI526B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI66CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A38.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3A78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{68900C00-D1AC-4940-B63A-CABA2BF18B17}\tapctl_create.ico	msiexec.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C2F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\Installer\{68900C00-D1AC-4940-B63A-CABA2BF18B17}\tapctl_create.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\e5830cf.msi	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2772	sc.exe
640	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\JScriptSetScriptStateStarted = "240668984"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe

Modifies registry class 57 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\EasyRSA = "\x06OpenSSL"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ovpn	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\" --command import \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\Drivers.OvpnDco = "Drivers"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\OpenVPN.GUI = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\OpenSSL = "\x06"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\res\\ovpn.ico,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\SourceList\Net\1 = "C:\\Program Files\\FreeVpnGuard\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\OpenVPN.Service = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\OpenVPN.Documentation = "OpenVPN"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\SourceList\LastUsedSource = "n;1;C:\\Program Files\\FreeVpnGuard\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\OpenVPN.SampleCfg = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\Drivers.Wintun = "Drivers"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\ProductIcon = "C:\\Windows\\Installer\\{68900C00-D1AC-4940-B63A-CABA2BF18B17}\\openvpn.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\ = "Import into OpenVPN-GUI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\PackageCode = "DA5475FBCED86AC45B29ACF62891E2C1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\Version = "33948849"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\ProductName = "OpenVPN 2.6.12-I001 amd64"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72\00C00986CA1D04946BA3ACABB21FB871	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\OpenVPN.PLAP.Register = "\x06OpenVPN.Service"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\OpenVPN.GUI.OnLogon = "OpenVPN.GUI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\Drivers.TAPWindows6 = "Drivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\SourceList\PackageName = "OpenVPN-2.6.12-I001-amd64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\OpenVPN	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00C00986CA1D04946BA3ACABB21FB871\Drivers	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00C00986CA1D04946BA3ACABB21FB871\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "import"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import\command	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4152	msiexec.exe
4152	msiexec.exe
2380	chrome.exe
2380	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe
2268	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2700	msiexec.exe
Token: SeSecurityPrivilege	4152	msiexec.exe
Token: SeCreateTokenPrivilege	2700	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2700	msiexec.exe
Token: SeLockMemoryPrivilege	2700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2700	msiexec.exe
Token: SeMachineAccountPrivilege	2700	msiexec.exe
Token: SeTcbPrivilege	2700	msiexec.exe
Token: SeSecurityPrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeLoadDriverPrivilege	2700	msiexec.exe
Token: SeSystemProfilePrivilege	2700	msiexec.exe
Token: SeSystemtimePrivilege	2700	msiexec.exe
Token: SeProfSingleProcessPrivilege	2700	msiexec.exe
Token: SeIncBasePriorityPrivilege	2700	msiexec.exe
Token: SeCreatePagefilePrivilege	2700	msiexec.exe
Token: SeCreatePermanentPrivilege	2700	msiexec.exe
Token: SeBackupPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeShutdownPrivilege	2700	msiexec.exe
Token: SeDebugPrivilege	2700	msiexec.exe
Token: SeAuditPrivilege	2700	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2700	msiexec.exe
Token: SeChangeNotifyPrivilege	2700	msiexec.exe
Token: SeRemoteShutdownPrivilege	2700	msiexec.exe
Token: SeUndockPrivilege	2700	msiexec.exe
Token: SeSyncAgentPrivilege	2700	msiexec.exe
Token: SeEnableDelegationPrivilege	2700	msiexec.exe
Token: SeManageVolumePrivilege	2700	msiexec.exe
Token: SeImpersonatePrivilege	2700	msiexec.exe
Token: SeCreateGlobalPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeAuditPrivilege	4296	svchost.exe
Token: SeSecurityPrivilege	4296	svchost.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeLoadDriverPrivilege	3672	MsiExec.exe
Token: SeRestorePrivilege	640	DrvInst.exe
Token: SeBackupPrivilege	640	DrvInst.exe
Token: SeLoadDriverPrivilege	640	DrvInst.exe
Token: SeLoadDriverPrivilege	640	DrvInst.exe
Token: SeLoadDriverPrivilege	640	DrvInst.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2236	Free-VPN-Guard.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4352	FVGSetup.exe
2236	Free-VPN-Guard.exe
2236	Free-VPN-Guard.exe
4316	openvpn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2700	4352	FVGSetup.exe	97
PID 4352 wrote to memory of 2700	4352	FVGSetup.exe	97
PID 4152 wrote to memory of 2236	4152	msiexec.exe	100
PID 4152 wrote to memory of 2236	4152	msiexec.exe	100
PID 4152 wrote to memory of 3672	4152	msiexec.exe	102
PID 4152 wrote to memory of 3672	4152	msiexec.exe	102
PID 4296 wrote to memory of 3612	4296	svchost.exe	120
PID 4296 wrote to memory of 3612	4296	svchost.exe	120
PID 4296 wrote to memory of 4524	4296	svchost.exe	109
PID 4296 wrote to memory of 4524	4296	svchost.exe	109
PID 4296 wrote to memory of 684	4296	svchost.exe	111
PID 4296 wrote to memory of 684	4296	svchost.exe	111
PID 4296 wrote to memory of 640	4296	svchost.exe	130
PID 4296 wrote to memory of 640	4296	svchost.exe	130
PID 3672 wrote to memory of 4896	3672	MsiExec.exe	117
PID 3672 wrote to memory of 4896	3672	MsiExec.exe	117
PID 4296 wrote to memory of 3612	4296	svchost.exe	120
PID 4296 wrote to memory of 3612	4296	svchost.exe	120
PID 3672 wrote to memory of 2044	3672	MsiExec.exe	121
PID 3672 wrote to memory of 2044	3672	MsiExec.exe	121
PID 4296 wrote to memory of 3532	4296	svchost.exe	123
PID 4296 wrote to memory of 3532	4296	svchost.exe	123
PID 3672 wrote to memory of 1668	3672	MsiExec.exe	124
PID 3672 wrote to memory of 1668	3672	MsiExec.exe	124
PID 3672 wrote to memory of 2772	3672	MsiExec.exe	128
PID 3672 wrote to memory of 2772	3672	MsiExec.exe	128
PID 3672 wrote to memory of 640	3672	MsiExec.exe	130
PID 3672 wrote to memory of 640	3672	MsiExec.exe	130
PID 2236 wrote to memory of 3984	2236	Free-VPN-Guard.exe	141
PID 2236 wrote to memory of 3984	2236	Free-VPN-Guard.exe	141
PID 2236 wrote to memory of 2276	2236	Free-VPN-Guard.exe	142
PID 2236 wrote to memory of 2276	2236	Free-VPN-Guard.exe	142
PID 2380 wrote to memory of 3864	2380	chrome.exe	145
PID 2380 wrote to memory of 3864	2380	chrome.exe	145
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146
PID 2380 wrote to memory of 3088	2380	chrome.exe	146

C:\Users\Admin\AppData\Local\Temp\FVGSetup.exe
"C:\Users\Admin\AppData\Local\Temp\FVGSetup.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\system32\msiexec.exe
  C:\Windows\system32\msiexec.exe /i "C:\Program Files\FreeVpnGuard\OpenVPN-2.6.12-I001-amd64.msi" /quiet
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CE447D31B9ECF65DA4648FDB7C3FAFB2
  2⤵
  - Loads dropped DLL
  PID:2236
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C0F6DD896AF34A224CC69B51BCB2477D E Global\MSI0000
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4896
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2044
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1668
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config OpenVPNService start= auto
    3⤵
    - Launches sc.exe
    PID:2772
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start OpenVPNService
    3⤵
    - Launches sc.exe
    PID:640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\Temp\6c5b298024427ae09dc929e24a09eac899720625ed9544b87e3139526fa6b6c6\wintun.inf" "9" "44006a23b" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Windows\Temp\6c5b298024427ae09dc929e24a09eac899720625ed9544b87e3139526fa6b6c6"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3612
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\Temp\7c447ebf4ac5de88a8a6dc8efe57bcf9e7defd1ad02da8db6410eaef156d88ba\OemVista.inf" "9" "4c96e98cb" "0000000000000150" "WinSta0\Default" "0000000000000154" "208" "C:\Windows\Temp\7c447ebf4ac5de88a8a6dc8efe57bcf9e7defd1ad02da8db6410eaef156d88ba"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4524
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf" "9" "4e1f3ffd3" "0000000000000154" "WinSta0\Default" "0000000000000138" "208" "C:\Program Files\Common Files\ovpn-dco\Win10"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:684
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "0000000000000168"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "0000000000000138"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:3612
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\INF\oem5.inf" "oem5.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "000000000000017C"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:3532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:1600

C:\Program Files\OpenVPN\bin\openvpnserv.exe
"C:\Program Files\OpenVPN\bin\openvpnserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952

C:\Program Files\OpenVPN\bin\openvpnserv2.exe
"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
1⤵
- Executes dropped EXE
PID:2872

C:\Program Files\FreeVpnGuard\Free-VPN-Guard.exe
"C:\Program Files\FreeVpnGuard\Free-VPN-Guard.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\DeviceAssociationBrokerSvc_60ca11.exe
  C:\Windows\system32\DeviceAssociationBrokerSvc_60ca11.exe /INSTALL /SILENT
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\system32\OpenSSH\ssh-keygen.exe
  C:\Windows\system32\OpenSSH\ssh-keygen.exe -t rsa -b 2048 -f C:\Users\Admin\.ssh\id_rsa -q -N ""
  2⤵
  PID:2276
- C:\Windows\system32\OpenSSH\ssh.exe
  C:\Windows\system32\OpenSSH\ssh.exe -N -o StrictHostKeyChecking=no -L 127.0.0.1:8443:127.0.0.1:8443 [email protected]
  2⤵
  PID:644
- C:\Program Files\OpenVPN\bin\openvpn.exe
  "C:\Program Files\OpenVPN\bin\openvpn.exe" --config "C:\Users\Admin\AppData\Local\Temp\45-3cb5daff-117b-4f0b-9800-c76d6ae5f00b.ovpn"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbc94ecc40,0x7ffbc94ecc4c,0x7ffbc94ecc58
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1852,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3764,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4496,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4828,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4508,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4944,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5244,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5336,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4900,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3804,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3392,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3256 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3416,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5088,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4692 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5240,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4988,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4780,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5588,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5704,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5116,i,7604911780765660775,14887208793533068446,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5830d2.rbs

Filesize
857KB

MD5
ef29db6a56d20811b7afa1a0ed0678d6

SHA1
fb05753528e635639556c5470776c5de8fc567d9

SHA256
8c14b3f64397de5f9e5c9e8e0bc2c9e0089de9c70549ec974b05f2a068ebdec5

SHA512
3cc3ec78f4d6789ecc255d11f7364cadeb3e2123bf8a975ea4c37194cc65e373ea7b0004fcac7bc3727a249a25fd34b4cbd909ca5cc2cc6bbb9d317038da25c5

Download Submit
C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.sys

Filesize
89KB

MD5
5e69b6c42467b2673101e592a2b28638

SHA1
16d076f57b3cbdbe945c6666676823871f5c90d1

SHA256
2357e4d2007f346a3d2b3bf05115caeaf3eb069a70be654ce472be71e6f7fc75

SHA512
232e9441db8da52cd5e6f29baf5340b0540125074a7ccc9d4754762c56460b72327f89d6583a8afde71ed400433eb850e1eb2b9d5fc536d8f9c18992b83fa587

Download Submit
C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf

Filesize
2KB

MD5
77da079a3665afc84d05c3d07bcaa0d0

SHA1
3fbfafe2c08100f5b46b792398c2ecb9157760e9

SHA256
1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242

SHA512
10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507

Download Submit
C:\Program Files\FreeVpnGuard\Free-VPN-Guard.exe

Filesize
29.1MB

MD5
f1b44bfff7c75f0ae50129d7322f05c8

SHA1
a4713613cc3ffead0bd3debe8ee386e6fd5d3529

SHA256
d3536e997456734926d88cf7ebd0c00ef001c385c2bd9d3bece56f885d230177

SHA512
0d6f4f81ea62b805098d017d075210d1d24bb3341b674dab9af3c8feebc26a42d1180ee75a204b714e08e88e7e9f8fe01c9a472c6cfc281d6afeefb0a17f0934

Download Submit
C:\Program Files\FreeVpnGuard\OpenVPN-2.6.12-I001-amd64.msi

Filesize
5.2MB

MD5
635b9d9d72f6e455f35365801fb4b040

SHA1
a9df3d98eecfca7372c03fee38d530f5b7aebcf8

SHA256
525759fe9e52a77a7d2cad99f5af1923d7d3027cab775ccfb7469ce0fd2b1758

SHA512
4321f84f138845d02b0ff3c19d1fd307d5ac0eaea6721ea3d706661be41cfd292d7ad5905fd4a46ab029f9fa8c9a63096d7e1ca56eb8de1e1d161e45c055f633

Download Submit
C:\Program Files\OpenVPN\bin\VCRUNTIME140.dll

Filesize
94KB

MD5
5797d2a762227f35cdd581ec648693a8

SHA1
e587b804db5e95833cbd2229af54c755ee0393b9

SHA256
c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7

SHA512
5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e

Download Submit
C:\Program Files\OpenVPN\bin\openvpn-gui.exe

Filesize
868KB

MD5
4c22527190ac1ae2a0ae56d7a00796a3

SHA1
b7ced9467df11a149b5cc008cd8071745b0ba4d2

SHA256
ccb395aeb255c1b67a48d2792900e0ba50034abf6e96a63485c5e39f6e79de34

SHA512
8686c6a94daf63328609ac171753ba04acec8fe6c615bc5957de4b720e0f26af924225e6f3802dc0e489b75a2a233751c0b97a2664fb789b8c1326ae952216b1

Download Submit
C:\Program Files\OpenVPN\bin\openvpnserv.exe

Filesize
63KB

MD5
aabbde60aaaf46b0a4b1b136170bd4cd

SHA1
ddedf294dba6db03ae164997283f23d917a1d98f

SHA256
afbd423094f6c7af9496d0185e512ab4e950b2e8ac3811f19eabe7e0e1d02123

SHA512
635a93431ab2189c616f507e0b0e3bccd44dd3c2531437e08d1281ae5384e494699de15560f9c0fb1177d9ae3d2b267618df19eed57a76d51a39054b5b16d258

Download Submit
C:\Program Files\OpenVPN\bin\openvpnserv2.exe

Filesize
23KB

MD5
bc71317e0308cdbb60c144de84ab3c68

SHA1
01f4d0d5c856f9f283d93c7c909088e862679ec3

SHA256
d1e995a2d32e7833a369aa849e8b877162e07c1a161c6dccb95ca2052fc8b1e7

SHA512
17f2333020eb2375f79a4bcb4884662fba8129ada9de24e6d2ca51c623f0de16e6e7e5ba60a119b13474d6627b1807b466f886a414c120c5d0d85d7f71427ded

Download Submit
C:\Program Files\OpenVPN\bin\tapctl.exe

Filesize
41KB

MD5
0fb0cc41caa43667a02d4f1273688843

SHA1
25a79c7b406c0f8b24095684de2e17cf1ab2ef0b

SHA256
ffde0fe1e6aa7332c86aadfc1c6969866c808058a40b3dd771692eb479ded225

SHA512
e2bf78ebdfc6feb7e13ec51fa10e6ffc06380dc586c39ec2ac7b7574ce39ef3f86995c7597f253ce8e2e3bef474b092baff582ece28e796ef806d86ba4d6f8d7

Download Submit
C:\Users\Admin\.ssh\id_rsa.pub

Filesize
397B

MD5
50706a898e41d81452fc1836757a662d

SHA1
267dec7fb27ed6b7efb913cb218f0de10c0caa44

SHA256
52715eddd952ea9e3d7b3335264a213bb57177881d7782138e31608ef8c409f0

SHA512
d570cec0a1c5ba9ffd11be4ddd40d81eba6e615b7d7c2bcfff66dcebc4b3b091bb6630191201ba05741f8ab35082f753427ddcdc8b5401bc334030a5cdfc962f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
dbf14b88acad0aa74c204f94d1900631

SHA1
220c98b39c3161e64b3831cfb00414ac4b1c87da

SHA256
b4672665d85cfbcf894ce6aff8c35f7cb96359a44359bcbedd5fd05e3536263c

SHA512
eb6d70993f69e2bfc4a528c5e8cd7099bdde9f1b49306590f356221aa78db5f2d7d60b453a65d895a9e3def16b15b7247b4d53c4c54353f6a48e0f40659577fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
936B

MD5
535e51d56f374f865d9634bbb0071ea5

SHA1
0b3616bd4839cafc4664b32d6c01d7d559ca90aa

SHA256
bcbca1983532d65efc494429471b2f3d03400d829496095a16d9308a0af81015

SHA512
ac442c43db8096d2eabf2346410987a662353fe78cec945b3c057cdc524f25d05d96e280e221f9bd693ab50468f7f8fdd17e024ee7b11ad17c297d3344991bce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
1c2812b48342b2167c8663792c008440

SHA1
bb89e4f52a74b082bef6b5288a23b15577409c87

SHA256
562d7834e8b868c617b5c21ef3db0c3c769f42a882189b9f811a7e65a4efaf35

SHA512
f5a3a1c159ff935e38398816f03d127c7b76e4f0a31db0e450b12d01fcdcff88d985892e6b69f9e7459d623db7a5ae6cedc15a2ba6e622cccd6874d876e5cf9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
c23343e0e521eb942eb7a899f60e42e9

SHA1
85466d6bd8f002239083740c3be9b1acec876d23

SHA256
d86861f40e537d77f54b160e980902918e298e6f0118adcd5e687e0ad4774167

SHA512
0598587f7adb2f40b25db00eab8541f5d70b2309b8e5bf42f90ceceaa72f8dfe01d82100e5e345e1e0dfd36dd81915aa9e84a63969ec14ca639ee4e6b3824e76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
199cc57fef8c891aaed06893544dfa36

SHA1
36dd4ca4a5ca4a84408d192bd0f95f3c963f70b2

SHA256
cf1849300620833585234b9993fcee7e41a632edb23bdd75bd25ae4b1603a6c7

SHA512
92941eb0517d678c57f295e97a340b10712b54475af7660f3089f84847a9dfd4ba2f168bcdcb2d0734dfe057d8c2f58c3f20fa537dedae99828b353176ce42aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
87a50dbe96662abe5a78a4e6bbba2e45

SHA1
ae769d75fc1c98a6dab52a2baceb0595e13553e9

SHA256
45d0b48261b9aff99ef5f28822ab817e780703160a30ac67f72e0d0807dc3fdf

SHA512
e9bf9b8c3ec364dd98c4d6f0ed4192e23b61e3822c6da02dc3fa79e8d6a3344e3ffe1c3fa3123b215090b3f250794ca3715cae2adbc1638fac25f6f26f4028e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
47e58f2217845792ea3b8d417bf7bfeb

SHA1
0d722aa4f8f0ceefd05ec91b1775c8181e96e10a

SHA256
66c540e0c245fb0f478ef979bb0df6d01679cf799f4dffd4ab2332633dd175b4

SHA512
f12fdb0e87419b42f0b6988122d85136db9da4a51b79f7596f6dadad95ff48ec0fb2e21e61e0342be5dbd60c389c070b3f5d0893d8ddf9c37572144bbaf116f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
de39c72ddd5f12dd8eaf5ac9e3497698

SHA1
c03b298173bd7ec866e26fc22ceccfb9e1f972cc

SHA256
1081f2f786a2ee80e5895d3fafe1befcefb6b76fa2c6bdb795d59df9571ba564

SHA512
8efaedec7542e505b8539a3d689a8cd0881103675e4608e08904c4c5b08fd21fc5ad2a801c815b0d6c81bde3ccfc6d730e95b4eaaba7fccc9340631822a9fc88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6afe80dcec8b2d21694d5ba2f24bd2d7

SHA1
b012287e066ee492cce36ee6e14305cd61519c40

SHA256
e03e1dc93ebabcdcf95e23cbe6ffb706e5bd86af75090fa6c3bbc963940f0843

SHA512
49c7ee1cd803f0c19d78a67518f203ce45c9d70713f0d84742e3eae9ff628223a532e4fd1518d6e31d8365f74c10cec179e5d543935c53e96ca5306cdf9df30f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4ee63a65ff3445b1b660ad31bb680495

SHA1
b58612783461ca79334cc368715fae63f6c4dc4c

SHA256
da17de10c3f63b786c0e98c61e334341948c97f276b5f66520747d894fc85107

SHA512
59980fd9f52f691f75f28d313d0ccfaec67bec997d4a3879e64933a725d8773ec692781d35e4cbeafd7dbbedc134d2078aa880ac2269bcb96b260ec4d61d33ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e40b4a97b60b128984e77848c9bef6eb

SHA1
2f20ec6a5cd2bd409f6d3f25a73eec4aa01647c7

SHA256
7a4967bcc7f6c017ed1fea0c7f4795d3ce3e7a129e6c3032fb932eb4b8f186fd

SHA512
0098a04e56c9cc0af97af5fe2c48dc3b5c68ca03fda5e2b5762b227554682efe09d206f02cddc43217f8c835618eecaf76b8e053dc813d31bc9cfa053f35eec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c5473ab97d4e3cd16b781c6b9bb81574

SHA1
d581d2197dfa7fa0e64ac7ee2cd35fa16bfdc331

SHA256
7d399b0ad3959dbc9356b6b711fd6fb597e0a71a7ee35ce4f1bc1c551c4e2b7b

SHA512
8eb1c621b843c750e07d404ca124ef149fe1a297636cc07c941010050bafa3a96f4735e3fe1309a9fa45a58ec66efc2b2ba3d33b4ddbed6f7be1e98e3fa0cc6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
13KB

MD5
2910eff71021a99fe4b9dbf1dc011376

SHA1
a2b819e55ffbd850ce54dcf80a7eb954c70193a4

SHA256
84545937ef94ad7fe176caf02e56bfb9cf973aa2d7391c562027f5545531b838

SHA512
664d06a2cef1458786a5ea6ceb98c79ce21fea537a7e9ebcf419435ebe59facda7b11bc3f245e29001af6dfd87fc53029d854ddd5b3099215be7c0af85ee0ab9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6d2a1c1844cee71d8cf18f9a9a16ea8c

SHA1
7b649e5630bb257d3fa0c7b13ffb443a4e1596f6

SHA256
1b8fc286b5cad96d5f80989cca84c700661198ee5439b308c8362c3a3f1d2775

SHA512
362e58eddf9f3b2cdb44b852171eb20cca97b6288a5a108a103afb60e4ebc66a8763336c1e4e933baaeaa3a3010b7958e78cccaf22eb90a0cd9672799bddba50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
246KB

MD5
03b668b8bfc4fb97d849cf943fa34c7d

SHA1
bf9686214aaa88cbac9fb9453179c77702e3bde6

SHA256
181f88a77f0f1c87d82b2119c977b687247ab1e172108866e9b8a1f1cd8d791a

SHA512
3a2537245acb4ca261fd5c7291c0560675e369c0b88571641b45ed12f2e19e5e9c9267d05ddf8ab825d75f865cff193275c46017da4f3f3de4c368123d1d10b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
246KB

MD5
ad3626d88cc6859951b85562d0c7deec

SHA1
555e09cf5201abf4aa749404d67ec8c8be127930

SHA256
0630c244783528a1a129b751261857822e7229526978863061d335416c50952b

SHA512
1aa6f0ffecac2b7245a3b4a2f21e41265a9d18cff2615a6b4d4ad0ad1268bdc04110099e98b55012b9b981e4e640067fa4295a8211cd194bd4fb4c2ad2ac9b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZKC1FSM4\ip[1].txt

Filesize
14B

MD5
e3eb2b4cff0d56624daa49116976aeb4

SHA1
234db53081db6fc733d22a896f6dac5068eb066a

SHA256
3b9efd080931e6b2d3b89e8dcd2655792329a41c4699ffade4b48288bfdb0ffd

SHA512
ab0ce3a7301fe64594408380f5d55c8ebf24b0c94527fd2b29ff83bb2a10ab57be5a9de4ef56f532b0002e921c74cae14db0cc0f86d79e49d9d14f073d65d12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2380_1966584455\948479cc-64ab-4334-8e14-8be925643646.tmp

Filesize
150KB

MD5
eae462c55eba847a1a8b58e58976b253

SHA1
4d7c9d59d6ae64eb852bd60b48c161125c820673

SHA256
ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

SHA512
494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2380_1966584455\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Public\Desktop\OpenVPN GUI.lnk

Filesize
1KB

MD5
4e8cac8596620e5f4cabef61ba01475f

SHA1
11ab6fad76da5aabeaf5e5bfc1ed4c0761a9a4e9

SHA256
3730eada02a5726ec6121d477318670e19bf7554ea8a0639bc6159c5879e07e4

SHA512
a52fb496e9154fef356706280bd0adb205608fe2fcca0ba4f7ba6c8e7ba48841c4db13eea302d94bde23769af766b25dd7bcc6249f17f1bf4d03e438d1d66876

Download Submit
C:\Windows\Installer\MSI3479.tmp

Filesize
204KB

MD5
f97794a736b3c59ced7c005806fe9000

SHA1
18238e0df4a6a9ed3783449f4d9db0774c5de86a

SHA256
3f591a709e24a1d95fe81cbb7efe336e91a92299a95fdbda91addf9aa0763030

SHA512
6a89c856a0327601a3ad3d837b509c11359d1fc9b28181eac862e1df59aabb91261911e2e8f300a8482890c5bb6f8591cdd2ca0b6a3be7827d4c57ff225b86b5

Download Submit
C:\Windows\Installer\MSI3A38.tmp

Filesize
275KB

MD5
2232c07e354364e0eb1dc80024593826

SHA1
65bb4232c0416cfb2c158bfc32a7732ad72cee72

SHA256
fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f

SHA512
f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572

Download Submit
C:\Windows\Installer\MSI3A78.tmp

Filesize
281KB

MD5
718222e232d11298dfbabbc2b70d8b14

SHA1
89fc560692111c2245694867b8772fd8969f46d2

SHA256
45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c

SHA512
9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801

Download Submit
C:\Windows\Installer\MSI3AB7.tmp

Filesize
143KB

MD5
84a1cc9540d5cdad74bc54f8090dd27a

SHA1
c6f82d1491015457785ae0d365e7196d693d9a6b

SHA256
2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21

SHA512
9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
37KB

MD5
be209ba860598d787a508a735f90a57b

SHA1
e0b63973643f8423c7dc5eb5a41d224349abd359

SHA256
73286e10fe3420d18872ec0fdb1045c1d4e535682b05218400c0f045390d313d

SHA512
7838990cefa0e55379397e3a3f760bd2ed835a2ce447afa7d757450587df45ef0734be17736474ceb89da479f7899cc88cf3d3ba8395bc62abc79ea6f22c3222

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
37KB

MD5
3eb628d89a0964f3ae52fdf669858ddf

SHA1
dbe4568e8c8630aa6c0734d6c4cfaf747ec148f1

SHA256
ef30df30505a58bf4a58462606a624d3a37c35bbcef4a52f8ff653ba6f1cf03c

SHA512
3d3018ddebcf35107b231f090e89a6e7560badd59542381199ebf8575c42f851948fbd9a1992240b384916d83c89ad94a46b5d3d8d57a84331bac5f35185330e

Download Submit
C:\Windows\System32\DeviceAssociationBrokerSvc_60ca11.exe

Filesize
9.2MB

MD5
cfd60406e7a40998306f59e93bbf2be6

SHA1
6cc4279d83d77d63968af44fc8ae619941a1ff46

SHA256
3aeb15cb33fd85a5e27acb4fd3efac027e69c700fc6d38d08ea3a691e3d3a17d

SHA512
c606071f53d2ca3fb19990ced6ff119c8ca4a520d9f28c9f0bbf0b83df3334ff60f6ccc8b017206dd33dc489f1d84f7a1c88ff02b8d986f1ce9ac50ef8ba66c2

Download Submit
C:\Windows\System32\DriverStore\Temp\{4f8615c9-ddeb-e149-b127-fb6956f1825e}\ovpn-dco.cat

Filesize
11KB

MD5
5551203f3f1095335ff00421b16fd7e2

SHA1
0d14402407d60952f631dffe35240de3a1f910cb

SHA256
26c54ce26cb43407855ba24d10fbb30a87e5a1a0a35536025a02cb003fe474f4

SHA512
3c31b8f60bb59e4ac3c0cda8335af1918927c51b203c8b68f2601b390ad0bc0228cb9d5566dedef05ff38cabfce46eb3d54c52cd59c828bc17dcf0b1c24a8b08

Download Submit
C:\Windows\System32\DriverStore\Temp\{65d429e7-c15d-3b41-9ab8-3aa0c7ed6034}\tap0901.cat

Filesize
11KB

MD5
71ecece58bb00bdc1e728ee28d7a5332

SHA1
4305889415cf95662a30d024f1138f1af224cf42

SHA256
ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7

SHA512
9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b

Download Submit
C:\Windows\Temp\6C5B29~1\wintun.cat

Filesize
9KB

MD5
faba2ccb8fe366fd281ca6be6d2bb7c2

SHA1
bb7bd32a21f3eba652fde24146387ffc5278143e

SHA256
602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82

SHA512
ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214

Download Submit
C:\Windows\Temp\6C5B29~1\wintun.sys

Filesize
37KB

MD5
1945d7d1f56b67ae1cad6ffe13a01985

SHA1
2c1a369f9e12e5c6549439e60dd6c728bf1bffde

SHA256
eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b

SHA512
09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f

Download Submit
C:\Windows\Temp\6c5b298024427ae09dc929e24a09eac899720625ed9544b87e3139526fa6b6c6\wintun.inf

Filesize
1KB

MD5
8480579050970b0812cc3d9a1bce1340

SHA1
edebebd090602f4eee375ad754c8566d4fda23cb

SHA256
44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b

SHA512
46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933

Download Submit
C:\Windows\Temp\7C447E~1\tap0901.sys

Filesize
40KB

MD5
1bb9772a05517e227d1dafd3936e8f66

SHA1
d695ca5791a4b6a3509939aebdfaf5e229c6fbcf

SHA256
581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1

SHA512
3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2

Download Submit
C:\Windows\Temp\7c447ebf4ac5de88a8a6dc8efe57bcf9e7defd1ad02da8db6410eaef156d88ba\OemVista.inf

Filesize
7KB

MD5
6f5ffb58a9e406ab1643c890e2a198c6

SHA1
3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c

SHA256
1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9

SHA512
af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b

Download Submit
memory/2236-1194-0x0000000000100000-0x0000000001E49000-memory.dmp

Filesize
29.3MB

Download
memory/2236-625-0x0000000000100000-0x0000000001E49000-memory.dmp

Filesize
29.3MB

Download
memory/2236-1246-0x0000000000100000-0x0000000001E49000-memory.dmp

Filesize
29.3MB

Download
memory/2236-566-0x0000000000100000-0x0000000001E49000-memory.dmp

Filesize
29.3MB

Download
memory/2872-522-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/3984-564-0x0000000000400000-0x0000000000D3C000-memory.dmp

Filesize
9.2MB

Download
memory/4352-550-0x0000000000A10000-0x00000000030B2000-memory.dmp

Filesize
38.6MB

Download
memory/4352-0-0x00000286799E0000-0x00000286799E1000-memory.dmp

Filesize
4KB

Download
memory/4352-156-0x0000000000A10000-0x00000000030B2000-memory.dmp

Filesize
38.6MB

Download
memory/4352-3-0x0000000000A10000-0x00000000030B2000-memory.dmp

Filesize
38.6MB

Download
memory/4352-1-0x0000000000A10000-0x00000000030B2000-memory.dmp

Filesize
38.6MB

Download
memory/4352-2-0x00000286799E0000-0x00000286799E1000-memory.dmp

Filesize
4KB

Download